Refactor and enhance Ansible configurations for dev-02 and nginx proxy setup

- Updated host_vars for dev-02 to include login history settings and modified code server authentication.
- Adjusted opencode server configurations and reduced resource allocation.
- Introduced a new playbook for configuring nginx reverse proxy with TLS and OAuth2.
- Enhanced linux_dev_station role defaults and tasks, including package updates and service configurations.
- Removed unnecessary credential assertions in linux_dev_station tasks.
- Created nginx_proxy role with tasks for certbot, nginx installation, and oauth2-proxy setup.
- Added templates for nginx and oauth2-proxy configurations.
- Updated terraform configuration to reflect new DNS records for ide and agent services.
- Documented changes and configurations in linux_dev_station.md for clarity and future reference.

ansible/roles/nginx_proxy/tasks/certbot.yml

@@ -0,0 +1,60 @@
+---
+- name: Remove certbot installed via package manager
+  become: true
+  ansible.builtin.dnf:
+    name: certbot
+    state: absent
+
+- name: Install pip
+  become: true
+  ansible.builtin.dnf:
+    name: python3-pip
+    state: present
+
+- name: Install certbot and DNS plugin via pip
+  become: true
+  ansible.builtin.pip:
+    name:
+      - certbot
+      - certbot-dns-cloudns
+    state: present
+
+- name: Ensure CloudDNS credentials directory exists
+  become: true
+  ansible.builtin.file:
+    path: /etc/letsencrypt
+    state: directory
+    mode: '0700'
+
+- name: Create CloudDNS credentials file
+  become: true
+  ansible.builtin.copy:
+    content: |
+      dns_cloudns_auth_id={{ nginx_proxy_cloudns_auth_id }}
+      dns_cloudns_auth_password={{ nginx_proxy_cloudns_auth_password }}
+    dest: "{{ nginx_proxy_certbot_credential_file }}"
+    mode: "{{ nginx_proxy_certbot_credential_mode }}"
+    owner: root
+    group: root
+
+- name: Obtain TLS certificate via DNS-01 challenge
+  become: true
+  ansible.builtin.command: >-
+    certbot certonly
+    --authenticator dns-cloudns
+    --dns-cloudns-credentials {{ nginx_proxy_certbot_credential_file }}
+    --dns-cloudns-nameserver {{ nginx_proxy_cloudns_nameserver }}
+    -d {{ __nginx_proxy_certbot_domains | join(' -d ') }}
+    --non-interactive
+    --agree-tos
+    -m {{ nginx_proxy_certbot_email }}
+  args:
+    creates: "/etc/letsencrypt/live/{{ __nginx_proxy_certbot_domains[0] }}/fullchain.pem"
+
+- name: Create certbot renewal cron job
+  become: true
+  ansible.builtin.cron:
+    name: "certbot renewal"
+    minute: "{{ nginx_proxy_certbot_cron_minute }}"
+    hour: "{{ nginx_proxy_certbot_cron_hour }}"
+    job: "certbot renew --deploy-hook 'systemctl reload nginx'"